[sineld]

Fixes #49

Replaces #13, which closed when develop was removed. Same commits, merged with main; nothing else changed.

This lets Flock serve its sites and *.test DNS on further addresses of the machine, for other machines. The case it's for: a development box reached over Tailscale (or another trusted network) from a laptop, where the sites should open in the laptop's browser.

{ "listen": ["100.94.14.19"] }

Without listen, nothing changes: everything stays on 127.0.0.1.

What it does

• Web:
  • Caddy also listens on the listen addresses: withBind now expands each :port to one address per host.
  • The remote-client check (@remote not client_ip 127.0.0.0/8 ::1) exempts requests that arrived on a listen address: not vars {http.request.local.host} <addresses>.
  • The certificate source applies the same rule, so other machines get certificates only on those addresses.
  • Elsewhere, including the wildcard bind macOS uses for ports below 1024, remote clients are still refused.
• DNS:
  • The server listens on the same port of every listen address.
  • A query is answered with the address it reached: 127.0.0.1 on loopback, as before, and the tailnet address for a query that came over the tailnet. That's what the other machine can connect to.
• Validation: only IPv4 addresses of this machine are used. Loopback, unspecified, non-IPv4 addresses and addresses not on an interface are reported as warnings, and the rest still works.
  • A tailnet address that isn't up yet (the VPN connects after the daemon starts) makes the daemon degraded. Its retries bind the address once it's there.
• flock status lists the addresses (listen 100.94.14.19 (sites and DNS, for other machines)), and api.Status carries them.

Security: requests arriving on a listen address are served whoever sends them. The config comment says to list only addresses of trusted networks.

On the other machine, the TLD is pointed at the box's DNS (macOS: /etc/resolver/test with nameserver 100.94.14.19 and port 53535), and Flock's CA is trusted there.

Not in this PR

• The services (PostgreSQL, MySQL, ...) still listen on 127.0.0.1 only.
• There's no CLI command or app setting yet: listen is set in config.json, then the daemon is reloaded.

Testing

• Unit tests:
  • DNS answers with the address each query reached, over UDP and TCP. This test runs on Linux only, because it needs 127.0.0.2.
  • withBind expands to every host.
  • The Caddyfile has the exemption only with listen, and it adapts.
  • The certificate source serves remote clients only on a listen address.
  • listenAddresses keeps this machine's IPv4 addresses and reports the others.
• End to end: on Ubuntu 24.04 arm64 with the Linux support from feat: Linux support for the CLI and daemon #12, using the box's tailnet address and one that isn't on the machine:
  • DNS answered 127.0.0.1 on loopback and the tailnet address over the tailnet, subdomains included.
  • HTTPS over the tailnet address returned 200, and PHP saw the tailnet address as both server and client. A subdomain worked too.
  • flock status listed the address and warned about the missing one, while local sites kept working.
• go test -race ./... passed on that branch.
• Merged with main. go build ./..., go vet ./... and go test ./... pass on Linux, and go vet also passes for darwin and windows.

Docs

• docs/configuration.md gets Working from another machine. It covers setting listen and restarting, what's served there and to whom (trusted networks only, services stay on 127.0.0.1), and the warnings and the degraded state. On the other machine it covers /etc/resolver/test on macOS or the hosts file elsewhere, and trusting certs/ca.crt. The config.json list mentions listen.
• docs/https.md points there from the CA section.
• The app view says listen isn't in the app yet.